virexacapital[.]com

virexacapital.com is an active domain registered on February 12, 2026 through Ultahost, Inc. The site presents a page titled “VirexaCapital Trading | CFD Trading — Trading on Stocks, Gold, Oil, Indices,” which mimics legitimate CFD‑trading services. It uses a Let’s Encrypt R12 certificate, indicating a valid TLS handshake, and returns an HTTP 301 redirect, suggesting an attempt to conceal the final landing page. The domain resolves to 84.200.205.134, an address allocated to a German hosting provider associated with Ultahost, and is served by four authoritative name servers (ns1‑ns4.ultahost.com).

Analysis from VirusTotal shows that 12 of 95 scanned security vendors flagged the domain as malicious, providing independent confirmation of its phishing intent. The site is listed on a single security blocklist and has been blocked by the PhishDestroy feed. Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting an extremely low reputation. These indicators, combined with the generic phishing classification, confirm that the domain is being used to harvest credentials or financial information from unsuspecting visitors.

Defenders should add 84.200.205.134 to network deny lists and enforce DNS filtering for virexacapital.com and its four Ultahost name servers. Email gateways should block URLs containing the domain and monitor for credential submissions to the observed page title. Because the site employs a valid TLS certificate and a simple redirect, passive TLS inspection may be required to detect malicious payloads. Continuous monitoring of the domain’s DNS records and the associated IP range is advised, as the operators could pivot to additional infrastructure or change the landing page without notice.